Skip to main content

Prime Data Center Network Manager CVE-2018-0464

HIGH
Path Traversal (CWE-22)
2018-10-05 psirt@cisco.com
8.1
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 05, 2018 - 16:29 nvd
HIGH 8.1

DescriptionNVD

A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management interface. An attacker could exploit this vulnerability by sending malicious requests containing directory traversal character sequences within the management interface. An exploit could allow the attacker to view or create arbitrary files on the targeted system.

AnalysisAI

A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management interface. An attacker could exploit this vulnerability by sending malicious requests containing directory traversal character sequences within the management interface. An exploit could allow the attacker to view or create arbitrary files on the targeted system. Affected products include: Cisco Prime Data Center Network Manager.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

CVE-2013-5486 CRITICAL POC
10.0 Sep 23

Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager

CVE-2017-6640 CRITICAL
9.8 Jun 08

A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attack

CVE-2017-6639 CRITICAL
9.8 Jun 08

A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM)

CVE-2012-5417 CRITICAL
10.0 Nov 02

Cisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to certain JBoss MainDepl

CVE-2018-0258 CRITICAL
9.8 May 02

A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker t

CVE-2013-5490 HIGH
7.8 Sep 23

Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to read arbitrary text files via an

CVE-2013-5487 HIGH
7.8 Sep 23

DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to read arbitrar

CVE-2013-1196 MEDIUM
6.8 Apr 29

The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Direc

CVE-2018-0144 MEDIUM
6.1 Mar 08

A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthen

CVE-2014-3329 MEDIUM
4.3 Jul 29

Cross-site scripting (XSS) vulnerability in the web-server component in Cisco Prime Data Center Network Manager (DCNM) 6

Share

CVE-2018-0464 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy